EUVD-2026-31878
GHSA-w4ph-7vgc-vxrf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (Joomla) · only source for this CVE.
CVSS VectorVendor: Joomla
Lifecycle Timeline
4DescriptionCVE.org
The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.
AnalysisAI
Transport encryption downgrade in Joomla! CMS password and username reset workflows causes reset links to be generated with plain HTTP URLs instead of HTTPS when the 'Force SSL' configuration flag is not explicitly enabled. Affected installations span Joomla! 3.9.0 through 5.4.5 and 6.0.0 through 6.1.0, exposing reset tokens to network interception. No public exploit identified at time of analysis, and EPSS scores exploitation probability at 0.02% (5th percentile) despite the 9.8 CVSS rating.
Technical ContextAI
Joomla! is a widely deployed PHP-based content management system that includes self-service account recovery flows for password and username reset. The reset workflow emails users a tokenized link that, when visited, allows them to complete the recovery action. According to the Joomla! developer advisory, the link-construction logic uses the configured site URL scheme rather than forcing HTTPS, so when an administrator has not enabled the 'Force SSL' option in global configuration the framework emits http:// URLs even on sites that serve traffic over TLS. This is a transport encryption downgrade pattern (aligned with CWE-319 Cleartext Transmission of Sensitive Information, though no CWE was assigned in the input) where a sensitive bearer token is delivered to the user agent in clear-text-capable form. The CPE explicitly identifies cpe:2.3:a:joomla!_project:joomla!_cms as the affected product family.
RemediationAI
Patch available per vendor advisory: upgrade to a fixed Joomla! release above 5.4.5 on the 3.x-5.x line and above 6.1.0 on the 6.x line as published in the Joomla! Security Centre bulletin at https://developer.joomla.org/security-centre/1050-20260518-core-transport-encryption-downgrade-for-password-and-username-reset-links.html (exact patched build numbers should be taken from that advisory, as the input data does not enumerate them). As an immediate compensating control administrators should enable the 'Force SSL = Entire Site' option in Global Configuration, which causes Joomla! to always emit https:// URLs (including in reset emails) - the trade-off is that any legacy embedded resource still referenced over http will need to be migrated to avoid mixed-content breakage. Additionally, enforce HSTS at the web server or CDN layer so that even if an http link is generated the user agent upgrades the request before it leaves the browser, accepting that HSTS only protects users who have previously visited the site over HTTPS.
More in Joomla Cms
View allUnrestricted SHTML file upload in Joomla! CMS affects all versions from 1.0.0 through 5.4.7 and 6.0.0 through 6.1.2, imp
Path traversal (Zip Slip) in Joomla 6.1.1's com_joomlaupdate component enables persistent remote code execution when a S
Arbitrary file deletion in Joomla! CMS com_joomlaupdate component via the autoupdate server mechanism allows remote atta
Authorization bypass in Joomla CMS com_config webservice endpoints allows authenticated attackers with high privileges t
Improper access control in Joomla! CMS webservice endpoints allows unauthorized attackers to bypass authentication and a
Inconsistent access control enforcement in Joomla! CMS REST API webservice endpoints allows authenticated users with ins
Multi-factor authentication bypass in Joomla! CMS versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2 allows remote att
Authentication bypass in Joomla! CMS 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to circumvent multi-factor auth
Two-factor authentication bypass in Joomla! CMS versions 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to circumve
Privilege escalation in Joomla! CMS versions 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0 allows remote attackers to abus
Privilege escalation in Joomla! CMS versions 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to abuse the com_users
Information disclosure in Joomla! CMS arises because InputFilter::getInstance() builds its instance cache key without in
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today